- Federal privacy legislation generally requires an organization to obtain meaningful consent before collecting, using, or disclosing an individual's personal information for a business…
- Decide what's actually relevant to the role before you post the job.
Verifying a candidate's background before you hire them is common, sensible practice — but it puts an Ontario employer squarely into privacy law and human rights territory. Running the wrong kind of check, on the wrong candidate, without proper consent, can create legal exposure even if the hiring decision itself was entirely reasonable. This guide walks through the main types of pre-employment checks, what consent they require, and where employers most often go wrong.
The Foundational Rule: Meaningful Consent
Federal privacy legislation generally requires an organization to obtain meaningful consent before collecting, using, or disclosing an individual's personal information for a business purpose — and running a background check on a job candidate is exactly that kind of collection. In practice, this means:
- Tell candidates clearly what kind of check you intend to run, before you run it.
- Get their consent in writing, ideally as a distinct, clearly worded authorization rather than a buried line in a lengthy application form.
- Only collect what's genuinely relevant to the role — broad, generic background checks run on every candidate regardless of position are harder to justify than checks tailored to the job's actual requirements.
- Be prepared to explain to a candidate, if asked, what you collected and why.
Common Types of Pre-Employment Checks
| Type of check | What it covers | Key legal consideration |
|---|---|---|
| Reference checks | Verifying employment history and performance with past employers or supervisors | Generally lower-risk, but still requires the candidate's knowledge and consent |
| Employment and education verification | Confirming dates of employment, job titles, and credentials claimed | Straightforward if limited to factual verification |
| Criminal record checks | Searching for a criminal record, sometimes including a vulnerable-sector check for roles involving vulnerable people | Must be job-relevant; human rights protections around certain categories of past offences apply and are technical — get this reviewed |
| Credit checks | Reviewing a candidate's credit history, typically through a consumer reporting agency | Generally only appropriate for roles genuinely involving financial responsibility, and triggers additional consumer-reporting consent rules beyond ordinary privacy consent |
| Social media or online searches | Reviewing a candidate's public online presence | Easy to inadvertently discover protected characteristics (age, religion, family status) that then can't unsee their way out of the hiring decision |
| Driving record checks | Verifying a candidate's driving history for roles that involve driving | Should be limited to roles where driving is a genuine job requirement |
A Step-by-Step Process for Running Checks Properly
- Decide what's actually relevant to the role before you post the job. Build your background check policy around the position, not a one-size-fits-all standard applied to every hire.
- Disclose your intent to run a background check in the job posting or early in the process, so candidates aren't surprised later.
- Get specific, written consent before initiating any check, clearly describing what will be checked.
- Use the check for its stated purpose only. Information gathered for a criminal record check shouldn't be repurposed to make assumptions about unrelated characteristics.
- Apply your background check policy consistently across candidates for the same role — inconsistent application is one of the fastest ways to create a discrimination complaint.
- Give the candidate a fair opportunity to respond if a check turns up something concerning, rather than rejecting them outright without any discussion — this is both fairer practice and reduces legal risk.
- Store the results securely and limit access to those involved in the hiring decision, consistent with your broader privacy obligations for personal information.
- Don't keep the information longer than necessary once the hiring decision is made.
Where Employers Commonly Get This Wrong
- Running a criminal record check on every hire, regardless of role, rather than tailoring the check to positions where it's genuinely relevant — this makes it harder to justify the check if ever challenged.
- Skipping written consent and treating a verbal mention of "we'll do a background check" as sufficient.
- Using social media searches as an informal background check without realizing how easily this exposes the employer to a candidate's protected characteristics, which then complicates defending a rejection decision.
- Rejecting a candidate based on a criminal record without understanding the specific, technical human rights protections around certain categories of past offences — this is a nuanced area (see our companion article on illegal interview questions) that should not be handled by informal policy alone.
- Treating a credit check like any other background check, without recognizing that pulling a candidate's credit history typically triggers its own additional consent and disclosure requirements.
Frequently asked questions
Do I need a candidate's written consent for every type of background check?
Meaningful consent is the general standard across the board, and written, specific consent is the safest way to demonstrate it — particularly for more sensitive checks like criminal records or credit history. Verbal or implied consent is a weaker position if a candidate later disputes what they agreed to.
Can I reject a candidate because of something I found on a criminal record check?
This depends heavily on the nature of the role, the nature of what was found, and specific human rights protections around certain categories of past offences that apply in Ontario. This is not an area to navigate by instinct — get legal advice before making a rejection decision based on a criminal record.
Is it legal to Google a candidate or look at their public social media?
Reviewing publicly available information isn't automatically prohibited, but it carries real risk: it's very easy to stumble onto a candidate's age, family status, religion, or other protected characteristics this way, which then makes it harder to show those characteristics played no role in your hiring decision.
How long can I keep background check results after making a hiring decision?
General privacy principles favour keeping personal information only as long as it serves the purpose it was collected for. A background check kept indefinitely, long after a hiring decision is made, is harder to justify than one retained for a reasonable, defined period tied to your actual business need.
This is a corporate question
Start a file online — flat, published fees, reviewed by a licensed Ontario lawyer before a dollar is owed.